I discovered that passwords were being stored in the clear in postgres and have since moved to 2.1.11 to enable the auth_password_format scram:
{auth_method, internal}.
{auth_password_format, scram}.this breaks the mod_rest module I'm using for administering users
I tried checking out the ejabberd-modules code from trunk to build the absolute last version of mod_rest:
git clone git://github.com/last/ejabberd-modules.git